Configure Trust for CA Certificate

You have to download a CA certificate:

The CA certificate that was created for the Cloud Connector is needed on the server where PCo is installed. It must be downloaded and moved to the cloud services certificate store in PCo. This is a prerequisite for PCo being able to trust the CA certificate of the cloud.
1. Download the CA certificate in DER format using the download button on the Cloud Connector configuration UI (On Premise section), as shown in the following screenshot:
  
  Note
  
  The principal propagation is set to name by default (Subject Pattern: CN=$(name)), see screenshot above.
  
  You can change the subject pattern to other properties in the dialog box for principal propagation.
2. Move the CA certificate to the following folder on the server where PCo is installed:
  
  C:\ProgramData\SAP\PCo\CertificateStores\CloudServicesHost\Issuer\certs
Note

You need to make sure that PCo also knows the system certificate of the Cloud Connector that was issued by a trusted authority (Root CA). To do this, store the system certificate and, if necessary, the certificate chain in the folder C:\ProgramData\SAP\PCo\CertificateStores\CloudServicesHost\Issuer\certs.

Copy all intermediate certificates and the root certificate into C:\ProgramData\SAP\PCo\CertificateStores\CloudServicesHost\Issuer\certs.

For more information about root and intermediate certificates, see: https://help.sap.com/viewer/368c481cd6954bdfa5d0435479fd4eaf/Cloud/en-US/77a609451dbd46a58991e685c37350d8.html?q=Certificate%20chain